Mozilla Foundation Security Advisory 2006-26

Mail Multiple Information Disclosure

Announced

April 13, 2006

Reporter

CrashFr

Impact

Low

Products

Thunderbird

Fixed in

Thunderbird 1.0.8

Thunderbird 1.5.0.2

Description

As a privacy measure to prevent senders (primarily spammers)
from tracking when e-mail is read Thunderbird does not load
remote content referenced from an HTML mail message until a
user tells it to do so. This normally includes the content of
frames and CSS files, but CrashFr showed it was possible to
bypass this restriction through indirection: the direct
CSS or iframe src is included in-line, with that including
remote content.

Workaround

Switch the "view message body as..." choice to "Simple HTML" or
"Plain text". Or for POP mail, after downloading the mail
switch to offline mode before reading any of it.